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1/^ (57) Abstracrt: Apparams for monitoring operation of a pixxressing system (A, B, X) includes a set of modules (105) for moni- 

toring operation of a set of system primitives that allocate or release the system resources and are nsed by different processes nmning 
O on the system. Preferably, the modules include: at least one application knowledge module (lQ5a, 105b) tracking the processes 
^ running on the system and monitoring the resources used thereby, a netu-ork knowledge module (105c) monitoring connections by 
^ the processes running on the system, a file-system analysis module (105d) monitoring the file-related operations performed within 
the system, and a device monitoring module (105a) monitoring operation of conmionly used modoles with said system. A prefrared 
field of application is in host-based intnision detection systems (HIDS). 
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